crackthe.net
QR code scams (quishing) and how to avoid them
A QR code is a link you cannot read. That is exactly why scammers stick their own over the real ones – on parking meters, EV chargers and in letters. Here is how to stay safe.
QR codes have a problem no other kind of link has: you cannot see where they lead before you scan them. Scammers use exactly that – with printed stickers in public and with codes in letters that look entirely genuine. The technique is called quishing, and it works offline as well as online.
Where you will meet it
| Where | The pretext | What the scammer wants |
|---|---|---|
| Parking meter, EV charger | “Pay conveniently by QR” | Card details through a copied payment page |
| Restaurant table | Digital menu | Data capture, subscription trap |
| Letter with bank branding | “Verify your account” | Online banking credentials |
| Poster, flyer | Prize draw, survey | Personal details, subscription |
| Email attachment | “Security check on your phone” | Getting past the spam filter on your computer |
| Package, delivery slip | “Confirm your delivery” | Card details, malicious app |
Scanning safely
Four steps, every time
- 1. Feel for a sticker. Does the code feel like film stuck on top? Stop right there.
- 2. Use your camera app rather than some scanner app from the store.
- 3. Read the address in the preview before you open it – the real domain sits right before the first single slash.
- 4. Never enter payment or login details on a page you reached through a QR code.
There is a full walkthrough in Check a link before you click .
The rule for payments
Never pay through a QR code you found in public. Use the provider’s app, the card terminal on the machine, or type the address yourself. A real operator loses nothing if you ignore their code – a scammer loses everything.The letter version
The fake letters are the nastiest: good paper, correct logo, a plausible reason (“new security policy”, “re-verify your account”). Because mail feels more trustworthy than email, the QR code inside it seems harmless.
How to check: call your bank on the number on your card – never a number from the letter. And open banking only through the app or an address you typed yourself. More on that in Online banking fraud .
If you already scanned and entered something
- Card details: lock the card immediately, then Credit card misused .
- Banking login or a one-time code: call your bank, have access locked, then Online banking fraud .
- Any other login: change the password, end all sessions – see Check active sessions .
- An app got installed: Phone hacked .
The general sequence is in Clicked a phishing link .
The scam at a glance
Scammers stick their own QR codes over real ones, or send them in letters and emails. The code leads to a copy of a payment or login page.
How to recognize it
- A sticker sitting on top of a printed original
- The code leads to a payment or a sign-in
- The preview shows a domain that does not belong to the business
What to do right away
- Read the address in the preview before you open it
- Pay through the provider's app or the card terminal instead
What never to do
- Enter card or login details on a page opened from a QR code
- Scan a QR code from an email or message you were not expecting
If you run a business
Anyone using QR codes can protect their own customers: print the codes permanently rather than sticking them on, check them regularly for tampering, and print the destination address next to the code as readable text. Then customers can compare instead of trusting blindly.
More scams are in the scams overview .
Frequently asked questions
Can a QR code itself contain malware?
No. A QR code only stores text, usually a web address. The danger is what comes after: a copied payment page, a download, or an app install in disguise.
How do I spot a manipulated code on a meter?
By the sticker. Run a finger over it – if there is an extra layer of film over a printed original, it is a scam. Codes that sit crooked, look glossy or do not match the surrounding print are suspicious too.
Are QR codes in letters from banks genuine?
Some are, many are not. There are convincing fake letters using real bank branding with a QR code for supposed verification. For anything touching your account or a payment: ignore the code, open the app or type the address yourself.